Analysis
- max time kernel
61s - max time network
111s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/11/2020, 14:00
Static task
static1
Behavioral task
behavioral1
Sample
a85b341635c65c3c54abae7bc1005c67.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a85b341635c65c3c54abae7bc1005c67.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target a85b341635c65c3c54abae7bc1005c67.exe
- Size 208KB
- Sample201117-775m6lshc6
- SHA256 0c5f5359cc0e057e46205acd94e818b293d8ccd1211b86c07b4bbcd68fa8a1dd
- MD5 a85b341635c65c3c54abae7bc1005c67
- SHA1 214e85b382031631d5129ead8894e3030fa1ff43
- SHA512 84937c2f7080f0cab29cb018f74d1358378877d710c6c04e9a790a835ee4f14feb1f6d5c4f867d18995a8b7505f7316ecbde368c9a0e36d18997d2ff0131915d
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- ServiceHost packer 16 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/2380-26-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2380-27-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2380-25-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2380-28-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2380-29-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2380-30-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2380-31-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2380-34-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2380-33-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2380-32-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3444-37-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3444-38-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3444-39-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/756-42-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/756-43-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/756-44-0x0000000000000000-mapping.dmp servicehost - Executes dropped EXE 3 IoCs
pid Process 3444 GIQDGL.exe 2380 VJH.exe 756 IZGGRTI.exe - Drops startup file 8 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VJH.exe VJH.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IZGGRTI.exe IZGGRTI.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IZGGRTI.exe IZGGRTI.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a85b341635c65c3c54abae7bc1005c67.exe a85b341635c65c3c54abae7bc1005c67.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a85b341635c65c3c54abae7bc1005c67.exe a85b341635c65c3c54abae7bc1005c67.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GIQDGL.exe GIQDGL.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GIQDGL.exe GIQDGL.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VJH.exe VJH.exe - Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b1dd1a1a = "C:\\windows\\SysWOW64\\VJH.exe" VJH.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\b1dd1a1a = "C:\\windows\\SysWOW64\\VJH.exe" VJH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\78a57142 = "C:\\windows\\SysWOW64\\IZGGRTI.exe" IZGGRTI.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\78a57142 = "C:\\windows\\SysWOW64\\IZGGRTI.exe" IZGGRTI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b457e191 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a85b341635c65c3c54abae7bc1005c67.exe" a85b341635c65c3c54abae7bc1005c67.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\b457e191 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a85b341635c65c3c54abae7bc1005c67.exe" a85b341635c65c3c54abae7bc1005c67.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\e48d22d2 = "C:\\windows\\GIQDGL.exe" GIQDGL.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\e48d22d2 = "C:\\windows\\GIQDGL.exe" GIQDGL.exe - Drops file in System32 directory 6 IoCs
description ioc Process File created C:\windows\SysWOW64\VJH.exe.bat a85b341635c65c3c54abae7bc1005c67.exe File created C:\windows\SysWOW64\IZGGRTI.exe VJH.exe File opened for modification C:\windows\SysWOW64\IZGGRTI.exe VJH.exe File created C:\windows\SysWOW64\IZGGRTI.exe.bat VJH.exe File created C:\windows\SysWOW64\VJH.exe a85b341635c65c3c54abae7bc1005c67.exe File opened for modification C:\windows\SysWOW64\VJH.exe a85b341635c65c3c54abae7bc1005c67.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\windows\GIQDGL.exe a85b341635c65c3c54abae7bc1005c67.exe File opened for modification C:\windows\GIQDGL.exe a85b341635c65c3c54abae7bc1005c67.exe File created C:\windows\GIQDGL.exe.bat a85b341635c65c3c54abae7bc1005c67.exe - Program crash 4 IoCs
pid pid_target Process procid_target 3228 3980 WerFault.exe 68 3064 2380 WerFault.exe 80 184 3444 WerFault.exe 79 1788 756 WerFault.exe 84 - Suspicious behavior: EnumeratesProcesses 336 IoCs
pid Process 3980 a85b341635c65c3c54abae7bc1005c67.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 2380 VJH.exe 2380 VJH.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 2380 VJH.exe 2380 VJH.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 2380 VJH.exe 2380 VJH.exe 3444 GIQDGL.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 2380 VJH.exe 3444 GIQDGL.exe 2380 VJH.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 2380 VJH.exe 3444 GIQDGL.exe 2380 VJH.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 756 IZGGRTI.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 3444 GIQDGL.exe 2380 VJH.exe 3444 GIQDGL.exe 2380 VJH.exe 756 IZGGRTI.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 756 IZGGRTI.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 3444 GIQDGL.exe 2380 VJH.exe 2380 VJH.exe 3444 GIQDGL.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 756 IZGGRTI.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 2380 VJH.exe 3444 GIQDGL.exe 2380 VJH.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 756 IZGGRTI.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 2380 VJH.exe 3444 GIQDGL.exe 2380 VJH.exe 756 IZGGRTI.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 756 IZGGRTI.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 3444 GIQDGL.exe 2380 VJH.exe 3444 GIQDGL.exe 2380 VJH.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 2380 VJH.exe 3444 GIQDGL.exe 2380 VJH.exe 3444 GIQDGL.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 2380 VJH.exe 3444 GIQDGL.exe 2380 VJH.exe 3444 GIQDGL.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 756 IZGGRTI.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 756 IZGGRTI.exe 2380 VJH.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 2380 VJH.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 2380 VJH.exe 3444 GIQDGL.exe 2380 VJH.exe 3444 GIQDGL.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 2380 VJH.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 2380 VJH.exe 756 IZGGRTI.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 756 IZGGRTI.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 2380 VJH.exe 2380 VJH.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 2380 VJH.exe 3444 GIQDGL.exe 2380 VJH.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 2380 VJH.exe 2380 VJH.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 2380 VJH.exe 3444 GIQDGL.exe 2380 VJH.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3064 WerFault.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 756 IZGGRTI.exe 1788 WerFault.exe 1788 WerFault.exe 1788 WerFault.exe 1788 WerFault.exe 1788 WerFault.exe 1788 WerFault.exe 1788 WerFault.exe 1788 WerFault.exe 1788 WerFault.exe 1788 WerFault.exe 1788 WerFault.exe 1788 WerFault.exe 1788 WerFault.exe 1788 WerFault.exe 1788 WerFault.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeRestorePrivilege 3228 WerFault.exe Token: SeBackupPrivilege 3228 WerFault.exe Token: SeDebugPrivilege 3228 WerFault.exe Token: SeDebugPrivilege 3064 WerFault.exe Token: SeDebugPrivilege 184 WerFault.exe Token: SeDebugPrivilege 1788 WerFault.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3980 a85b341635c65c3c54abae7bc1005c67.exe 3980 a85b341635c65c3c54abae7bc1005c67.exe 2380 VJH.exe 2380 VJH.exe 3444 GIQDGL.exe 3444 GIQDGL.exe 756 IZGGRTI.exe 756 IZGGRTI.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3980 wrote to memory of 2228 3980 a85b341635c65c3c54abae7bc1005c67.exe 75 PID 3980 wrote to memory of 2228 3980 a85b341635c65c3c54abae7bc1005c67.exe 75 PID 3980 wrote to memory of 2228 3980 a85b341635c65c3c54abae7bc1005c67.exe 75 PID 3980 wrote to memory of 2440 3980 a85b341635c65c3c54abae7bc1005c67.exe 77 PID 3980 wrote to memory of 2440 3980 a85b341635c65c3c54abae7bc1005c67.exe 77 PID 3980 wrote to memory of 2440 3980 a85b341635c65c3c54abae7bc1005c67.exe 77 PID 2228 wrote to memory of 3444 2228 cmd.exe 79 PID 2228 wrote to memory of 3444 2228 cmd.exe 79 PID 2228 wrote to memory of 3444 2228 cmd.exe 79 PID 2440 wrote to memory of 2380 2440 cmd.exe 80 PID 2440 wrote to memory of 2380 2440 cmd.exe 80 PID 2440 wrote to memory of 2380 2440 cmd.exe 80 PID 2380 wrote to memory of 2760 2380 VJH.exe 82 PID 2380 wrote to memory of 2760 2380 VJH.exe 82 PID 2380 wrote to memory of 2760 2380 VJH.exe 82 PID 2760 wrote to memory of 756 2760 cmd.exe 84 PID 2760 wrote to memory of 756 2760 cmd.exe 84 PID 2760 wrote to memory of 756 2760 cmd.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\a85b341635c65c3c54abae7bc1005c67.exe"C:\Users\Admin\AppData\Local\Temp\a85b341635c65c3c54abae7bc1005c67.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GIQDGL.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\windows\GIQDGL.exeC:\windows\GIQDGL.exe3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3444 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 8084⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:184
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VJH.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\windows\SysWOW64\VJH.exeC:\windows\system32\VJH.exe3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IZGGRTI.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\windows\SysWOW64\IZGGRTI.exeC:\windows\system32\IZGGRTI.exe5⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 8126⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1788
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 12204⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3064
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 11922⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3228
-